The present invention relates to securing message traffic in a data network, and more particularly to a service layer approach to implementing group security functions.
The following definitions are used in this document:
“Securing” implies both encryption of data in transit as well as authenticating that the data has not been manipulated in transit.
A “security policy” (or “policy”) defines data (or “traffic”) to be secured by a source IP address, a destination IP address, a port number, and/or a protocol. They also define the type of security to be performed.
A “security group” is a group of one or more nodes in a network that are assigned a common policy.
A “key” for a secure tunnel is the secret information used to encrypt and decrypt (or to authenticate and to verify) data in one direction of traffic in the secure tunnel.
A “Management and Policy Server” (MAP) is a device that is used to define high level security policies, which it then distributes to one or more Key Authority Points (KAPs).
A “Key Authority Point” (KAP) is a device that generates detailed policies from high level policies, which it then distributes to one or more Policy Enforcement Points (PEPs).
A “Policy Enforcement Point” (PEP) is a device or a function that secures data based on the policies.
Existing Network Security Technology
Data traffic in most computer networks is normally sent unsecured without encryption or strong authentication of the sender and receiver. This allows the traffic to be intercepted, inspected, modified, or redirected. Either the sender or receiver can falsify their identity. In order to allow private traffic to be sent in a secure manner, a number of security schemes have been proposed and are in use. Some are application dependent, as with a specific program performing password authentication, while others, such as TLS, are designed to provide comprehensive security to whole classes of traffic such as HTTP (Hyper-Text Transfer Protocol) and FTP (File Transfer Protocol).
IPsec is a protocol that was developed to address a broader security need. As the majority of network traffic today is over Internet Protocol (IP), IPsec was designed to provide encryption and authentication services to this traffic regardless of the application or transport protocol. This is done, in IPsec transport or tunnel modes. In either mode, the process involves encrypting a data packet (if encryption is required), performing a secure hash (authentication) on the packet, and wrapping the resulting packet in a new IP packet indicating it has been secured using IPsec.
Encryption keys (secrets) and other required configuration information must be exchanged by the parties involved in order for IPsec to work. This is accomplished using Internet Key Exchange (IKE), which is done in two phases.
In a first phase (IKE Phase 1), a connection between two parties is started in the clear. Using public key cryptographic mechanisms, where two parties may agree on a secret key by exchanging public data without a third party being able to determine the key, each party may determine a secret for use in the negotiation. Public key cryptography requires that each party either share secret information (pre-shared key) or exchange public keys for which they retain a private matching key. This is normally done with certificates, e.g., Public Key Infrastructure (PKI). Either of these methods authenticates the identity of the peer to some degree.
Once a secret has been agreed upon in IKE Phase 1, a second phase (IKE Phase 2) may begin and the specific secret and cryptographic parameters of a specific tunnel are developed. All traffic in IKE Phase 2 negotiations is encrypted by the secret from IKE Phase 1. When these negotiations are complete, a set of secrets and parameters for security have been agreed upon by the two parties and IPsec secured traffic may commence.
Security Gateways (SGWs) may be implemented at routers and other internetworking devices to implement IPsec in a tunnel mode, alleviating some of the responsibility for security from end nodes. When a packet is detected at a SGW with a source/destination pair that requires IPsec protection, the secret and other security association (SA) information are determined based on the Security Policy Database (SPD) and IPsec encryption and authentication is performed. The packet is then directed to a SGW that can perform decryption. At the receiving SGW, the IPsec packet is detected, and its security parameters are determined by a Security Packet Index (SPI) in the outer header. This is associated with the SA, and the secrets are found for decryption and authentication. If the resulting packet matches the policy, it is forwarded to the original recipient.